1name: crowdsecurity/vpatch-laravel-debug-mode
2description: "Detect bots exploiting laravel debug mode"
3#see https://github.com/s1miii/cape/blob/main/ler.py : bot is trying to trigger a debug log to extract secrets.
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: POST
11    - zones:
12        - BODY_ARGS_NAMES
13      transform:
14        - lowercase
15      match:
16        type: equals
17        value: "0x[]"
18labels:
19  type: exploit
20  service: http
21  confidence: 3
22  spoofable: 0
23  behavior: "http:exploit"
24  label: "Laravel Debug Mode - Exposure"
25  #while the vpatch doesn't address directly the CVEs below, it detects the bot that abuses them.
26  classification:
27   - attack.T1595
28   - attack.T1190
29   - cve.CVE-2017-16894
30   - cve.CVE-2021-41714
31   - cve.CVE-2019-17050
32